Privacy Policy

We process personal data (hereinafter usually just "data") only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents and the services offered there.

Pursuant to Article 4 No. 1 of Regulation (EU) 2016/679 — the General Data Protection Regulation (hereinafter "GDPR") — "processing" means any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

With the following privacy policy we inform you in particular about the nature, scope, purpose, duration and legal basis of the processing of personal data, insofar as we decide either alone or together with others on the purposes and means of processing. We also inform you about the third-party components used for optimisation and to improve user quality, insofar as third parties process data under their own responsibility.

Our privacy policy is structured as follows:

• I. Information about us as the data controller
• II. Rights of users and data subjects
• III. Information about data processing

I. Information about us as the data controller

The provider responsible for this website in the sense of data protection law is:

Wilfried & Julia Winterauer
Villa Salzweg
Gschwandt 48 / 6
Gschwandt 54
4822 Bad Goisern
Austria

Phone: +43 677 64117199
E-mail: [email protected]

The provider's data protection officer is: Wilfried Winterauer

II. Rights of users and data subjects

With regard to the data processing described in more detail below, users and data subjects have the right

• to confirmation as to whether data concerning them is being processed, to information about the data processed, to further information about the data processing and to copies of the data (cf. also Art. 15 GDPR);
• to correction or completion of inaccurate or incomplete data (cf. also Art. 16 GDPR);
• to immediate erasure of the data concerning them (cf. also Art. 17 GDPR), or, alternatively, where further processing is required pursuant to Art. 17 para. 3 GDPR, to restriction of processing in accordance with Art. 18 GDPR;
• to receive the data concerning them which they have provided and to transmit this data to other providers/data controllers (cf. also Art. 20 GDPR);
• to lodge a complaint with the supervisory authority if they are of the opinion that the data concerning them is being processed by the provider in violation of data protection regulations (cf. also Art. 77 GDPR).

In addition, the provider is obliged to inform all recipients to whom data has been disclosed by the provider of any correction or erasure of data or restriction of processing carried out on the basis of Articles 16, 17 para. 1, 18 GDPR. However, this obligation does not apply if this communication is impossible or involves disproportionate effort. Notwithstanding this, the user has a right to information about these recipients.

Users and data subjects also have the right under Art. 21 GDPR to object to the future processing of their data, insofar as the data is processed by the provider in accordance with Art. 6 para. 1 lit. f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.

III. Information about data processing

Your data processed when using our website will be deleted or blocked as soon as the purpose of storage no longer applies, the deletion of the data is not prevented by legal retention obligations and no other statements are made below on individual processing procedures.

Consent management / cookie consent (Klaro!)

To obtain and manage your consent regarding cookies and external services, we use the open-source tool Klaro! (provider: KIProtect GmbH, Berlin, Germany). Klaro! is loaded directly from our own web server (villa-salzweg.at); no personal data is transmitted to third parties.

Your selection is stored exclusively locally in your browser in a cookie named klaro-villa-salzweg (expires after 365 days). There is no server-side tracking.

The legal basis for using Klaro! is our legitimate interest (Art. 6 para. 1 lit. f GDPR) in lawfully integrating external services and implementing the requirements of § 165 para. 3 of the Austrian Telecommunications Act 2021 (TKG 2021).

You can change or completely revoke your consent at any time — via the "Change cookie settings" button at the top of this page or the corresponding link in the footer.

Personal data

Personal data is collected and processed on this website only to the technically necessary extent and in accordance with this privacy policy. In no case is the collected data sold or otherwise passed on to third parties. The exception are the services described below, which are only loaded with your explicit consent via our consent manager.

Smoobu booking widget

On the pages /buchen, /ferienwohnungen/... and in the booking strip on all apartment pages we embed the booking widget of the provider Smoobu GmbH, Wönnichstr. 68/70, 10317 Berlin, Germany. Smoobu shows a live availability calendar, lets you select arrival and departure dates and redirects you to Smoobu's booking flow when you book.

The widget is only loaded after your consent via the consent manager. If you agree, a connection is established to Smoobu's servers (login.smoobu.com), during which your IP address, browser type and referrer URL may be transmitted. Smoobu sets its own cookies (e.g. _smoobu_*) which are required for the widget to function.

Once you complete a booking, you transmit your contact data (name, e-mail, phone number, number of guests, stay period, possibly notes) directly to Smoobu. This data is processed by Smoobu on our behalf (data processing pursuant to Art. 28 GDPR) and provided to us as the landlord so that we can fulfil the rental contract.

The legal basis for embedding the widget is your consent under Art. 6 para. 1 lit. a GDPR. The legal basis for processing the booking data itself is the performance of the rental contract under Art. 6 para. 1 lit. b GDPR.

Smoobu's privacy policy: smoobu.com/datenschutz

Revyoos — live reviews

On our website we show current guest reviews with the widget of the provider Revyoos S.L., Carrer de Provença 290, 08008 Barcelona, Spain. Revyoos automatically collects our reviews from platforms like Google, Airbnb and Booking.com and displays them in a unified widget.

The widget is only loaded after your consent via the consent manager. When loaded, a connection is established to Revyoos's servers (revyoos.com), during which your IP address, browser type and referrer URL may be transmitted. According to our knowledge, Revyoos does not set its own tracking cookies but loads the widget via JavaScript.

The legal basis is your consent under Art. 6 para. 1 lit. a GDPR. Our legitimate interest is the transparent display of our guest reviews.

Revyoos's privacy policy: revyoos.com/w/privacy-policy

Hosting and delivery (Cloudflare)

Our website is provided via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages through a worldwide network of data centres and manages the DNS records of our domain.

When you visit the site, Cloudflare processes technically necessary connection data, in particular your IP address, date and time, the page requested and browser and device information.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing our website quickly, securely and reliably. A data processing agreement is in place with Cloudflare.

Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).

Cloudflare privacy policy: cloudflare.com/privacypolicy

Server data

For technical reasons, in particular to ensure a secure and stable website, data is transmitted by your internet browser to us or our hosting provider Cloudflare. These so-called server log files capture, among other things, the type and version of your browser, the operating system, the website from which you came to our site (referrer URL), the page(s) of our website you visit, the date and time of each access and the IP address of the internet connection from which our website is used.

This data is stored temporarily but not together with other data of yours.

This storage is based on Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in the improvement, stability, functionality and security of our website.

The data is deleted at the latest after seven days, unless further retention is required for evidentiary purposes. Otherwise, the data is wholly or partly excluded from deletion until the final clarification of an incident.

Cookies

a) Session cookies

We use so-called cookies on our website. Cookies are small text files or other storage technologies that are placed and stored on your device by the browser you use. Certain information from you, such as your browser or location data or your IP address, is processed by these cookies to a certain extent.

This processing makes our website more user-friendly, effective and secure, as it enables, for example, the display of our website in different languages or the offer of a shopping cart function.

The legal basis for this processing is Art. 6 para. 1 lit. b) GDPR, provided these cookies process data for contract initiation or contract execution.

If processing is not for contract initiation or contract execution, our legitimate interest lies in improving the functionality of our website. The legal basis is then Art. 6 para. 1 lit. f) GDPR.

When you close your internet browser, these session cookies are deleted.

b) Third-party cookies

Where applicable, our website also uses cookies from partner companies with whom we cooperate for advertising, analysis or functionality of our website. For details, in particular on the purposes and legal bases of processing such third-party cookies, please refer to the information below.

c) Disabling cookies

You can prevent or restrict the installation of cookies by configuring your internet browser. You can also delete cookies that have already been stored at any time. The required steps and measures depend on the browser you use; if you have any questions, please consult its help function or documentation. With so-called Flash cookies, processing cannot be prevented via the browser settings; instead, you must change the settings of your Flash player.

If you prevent or restrict the installation of cookies, this may mean that not all functions of our website can be used to their full extent.

Contact requests / contact options

If you contact us via a contact form or e-mail, the data you provide will be used to process your request. Providing this data is necessary to handle and answer your request — without it, we cannot answer your request or only to a limited extent.

The legal basis for this processing is Art. 6 para. 1 lit. b) GDPR.

Your data will be deleted once your request has been finally answered, unless legal retention obligations prevent deletion, e.g. in the case of subsequent contract execution.

Our enquiry and contact forms transmit your details via the service Web3Forms, which forwards them to us by e-mail. The data you enter and your IP address are processed in the process. According to the provider, form data is stored for a maximum of three years. The provider is based in India. Any transfer to third countries is based on EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR). The legal basis is Art. 6 para. 1 lit. b GDPR.

Web3Forms privacy policy: web3forms.com/privacy

AI assistant “Salty”

On our website you can ask our AI assistant “Salty” questions about our apartments, the house, day trips and available dates. Salty only becomes active when you open the chat window and send a question. We process your question, the previous conversation in that window and the page you are currently on. Please do not enter personal data such as names, addresses or payment details in the chat.

Your question is sent to our backend at Cloudflare (see “Hosting and delivery”) and from there to the AI service Claude by Anthropic PBC, San Francisco, USA, to generate an answer. Anthropic processes the data as a processor and, according to its own information, does not use it to train its models. The transfer to the USA is based on EU standard contractual clauses (Art. 46(2)(c) GDPR). For questions about available dates, Salty checks our booking calendar at Smoobu using only the apartment, the dates and the number of guests.

If you use voice input (microphone), the recording is only sent to Cloudflare Workers AI to be converted into text and is not stored afterwards. Your browser asks for your permission first.

We store questions and answers without names and without IP addresses in our database (Cloudflare, stored in the EU) to identify frequent questions and improve our information. We delete these entries after 12 months at the latest. To prevent abuse we limit the number of questions per day; for this, your IP address is only used in encrypted (hashed) form for a maximum of two days. The conversation in the chat window is only kept in your browser (sessionStorage) and is deleted when you close the tab. Salty does not set cookies.

The legal basis is our legitimate interest in answering your questions quickly and preventing abuse (Art. 6(1)(f) GDPR), or steps prior to entering into a contract when you ask about available dates (Art. 6(1)(b) GDPR). Answers are generated by AI and are provided without guarantee; your booking confirmation and our house rules are binding.

Anthropic privacy policy: anthropic.com/legal/privacy

YouTube videos

Occasionally we embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

YouTube videos are only loaded after your consent via the consent manager. Once you agree and start a video, a connection is established to YouTube/Google servers, transmitting your IP address, browser information, date, time and the page visited. YouTube sets cookies (e.g. VISITOR_INFO1_LIVE, YSC, PREF) and may process data in the USA.

We use YouTube in the so-called extended privacy mode (youtube-nocookie.com) — according to Google, no browser activity is stored as long as you don't play a video.

Data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (Adequacy Decision of the European Commission of 10 July 2023). Should Google not have an active certification status, additionally on the basis of standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Legal basis is your consent under Art. 6 para. 1 lit. a GDPR.

Google's privacy policy: policies.google.com/privacy

Facebook

To promote our products and services and to communicate with prospects and customers we operate a company presence on the Facebook platform. On this social media platform we are jointly responsible with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook's data protection officer can be reached via a contact form: facebook.com/help/contact

We have regulated joint responsibility in an agreement regarding the respective obligations in terms of the GDPR: facebook.com/legal/terms/page_controller_addendum

The legal basis for the processing of personal data taking place is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis, communication and the marketing of our products and services.

The basis may also be the user's consent pursuant to Art. 6 para. 1 lit. a GDPR towards the platform operator. The user can revoke this consent at any time pursuant to Art. 7 para. 3 GDPR with effect for the future by notifying the platform operator.

When accessing our online presence on the Facebook platform, Facebook Ireland Ltd. as the platform operator in the EU processes user data (e.g. personal information, IP address etc.).

This user data serves to provide statistical information about the use of our company presence on Facebook. Facebook Ireland Ltd. uses this data for market research and advertising purposes and to create profiles of users. Based on these profiles, Facebook Ireland Ltd. can, for example, advertise to users inside and outside of Facebook in an interest-based manner. If the user is logged into their Facebook account at the time of access, Facebook Ireland Ltd. can also link the data to the respective user account.

If a user contacts us via Facebook, the personal data of the user entered at that time will be used to process the request. The user's data will be deleted by us once the request has been finally answered and no legal retention obligations prevent deletion, e.g. in the case of subsequent contract execution.

For processing the data, Facebook Ireland Ltd. may also set cookies. If the user does not agree with this processing, they can prevent the installation of cookies by configuring their browser. Already stored cookies can also be deleted at any time. Settings depend on the respective browser. If the user prevents or restricts cookie installation, not all functions of Facebook may be fully usable.

For more on the processing activities, blocking them and deleting data processed by Facebook, see Facebook's data policy: facebook.com/privacy/explanation

It cannot be ruled out that processing by Facebook Ireland Ltd. also takes place via Facebook Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.

Instagram

To promote our products and services and to communicate with prospects and customers we operate a company presence on the Instagram platform. On this social media platform we are jointly responsible with Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Instagram's data protection officer can be reached via a contact form: facebook.com/help/contact

We have regulated joint responsibility in an agreement regarding the respective obligations in terms of the GDPR: facebook.com/legal/terms/page_controller_addendum

The legal basis for the processing of personal data taking place is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the analysis, communication and the marketing of our products and services.

Same processing terms apply as for Facebook above. For more information see Instagram's data policy: help.instagram.com/519522125107875

It cannot be ruled out that processing by Facebook Ireland Ltd. also takes place via Facebook Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.

Linking to social media via graphic or text link

On our website we also advertise presences on social networks. The integration is implemented via a linked graphic of the respective network. By using this linked graphic, an automatic connection to the respective server of the social network when calling up a website with social-media advertising is prevented. Only when the user clicks on the corresponding graphic is the user redirected to the service of the respective social network.

After the user has been redirected, information about the user is collected by the respective network. It cannot be ruled out that processing of the data collected in this way takes place in the USA.

These are initially data such as IP address, date, time and visited page. If the user is logged into their user account of the respective network at the same time, the network operator can assign the collected information about the specific user visit to the user's personal account. If the user interacts via a "share" button of the respective network, this information can be stored in the personal user account and possibly published. If the user wants to prevent the collected information from being directly assigned to their user account, they must log out before clicking the graphic. It is also possible to configure the respective user account accordingly.

The following social networks are linked from our site:

• Facebook – Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA. Privacy policy: facebook.com/policy.php
• YouTube – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. Privacy policy: policies.google.com/privacy
• Instagram – Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA. Privacy policy: help.instagram.com/519522125107875

Google Analytics 4

We use Google Analytics 4 (GA4) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the statistical analysis of the use of our website. GA4 helps us understand which pages are visited often, how long guests stay on the site and what devices they use — so we can improve the website in a targeted way.

Google Analytics is only loaded after your consent via the consent manager. Before that, no data is transmitted to Google.

The following is processed in particular: shortened IP address (IP anonymisation is enabled by default), pages visited and click path, time on page, browser and device information, approximate location (city/region level). The data is stored in cookies (e.g. _ga, _ga_*) and transmitted to Google servers.

Data transfer to the USA cannot be excluded. It takes place on the basis of the EU-US Data Privacy Framework (Adequacy Decision of the European Commission of 10 July 2023) or additionally on the basis of standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Legal basis is your consent under Art. 6 para. 1 lit. a GDPR. You can revoke this at any time via the cookie settings button at the top — afterwards no further data is transmitted to Google and existing Analytics cookies are deleted.

Google's privacy policy: policies.google.com/privacy · Storage period: GA4 deletes user-related data by default after 14 months.

Google Maps

On the page /kontakt we embed a map of the Google Maps service to show our location and directions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is only loaded after your consent via the consent manager. When loaded, a connection is established to Google servers, during which your IP address, browser type and the page visited may be transmitted. Google sets its own cookies (e.g. NID, OGPC, CONSENT) and may process data in the USA.

Data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (Adequacy Decision of the European Commission of 10 July 2023) or additionally on the basis of standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.

Legal basis is your consent under Art. 6 para. 1 lit. a GDPR. Before consent is given, the map is shown as a static placeholder; you can still open our location as a plain text link to Google Maps without an embedded connection being established.

Google's privacy policy: policies.google.com/privacy

Map services on activity pages (OpenStreetMap / Leaflet)

On the activity pages we show interactive maps with tips in the surrounding area. The maps are based on the open-source libraries Leaflet and MapLibre GL, loaded via unpkg.com, and use map data from OpenFreeMap (openfreemap.org) based on OpenStreetMap.

When an activity page with a map is loaded, a connection to the tile servers is automatically established; during this your IP address, browser type and requested map tiles are transmitted. No cookies are set and no tracking data is generated.

Legal basis is our legitimate interest under Art. 6 para. 1 lit. f GDPR in informative presentation of the region.